[tanvi-cd]

Rebuilt on the latest main. Three things, ending in a large deletion.

1. Drop the plugin's custom login stack (6709537)

The plugin shipped a second OAuth client: /crustdata:login, a 450-line browser/PKCE/DCR flow, a ~/.crustdata credential store with a cross-process refresh lock, an MCP headersHelper, a SessionStart token refresh, and a PreToolUse gate. Claude Code already does all of this for an http MCP server, so the layer was duplicated work carrying its own failure modes (the Windows/WSL and Node-24 fixes in this very PR were all fixes to that layer).

install.crustdata.com already serves everything the native flow needs — verified live:

Probe	Result
POST /mcp (no auth)	401 + www-authenticate: Bearer … resource_metadata=".../.well-known/oauth-protected-resource/mcp"
GET /.well-known/oauth-protected-resource/mcp	200 → authorization_servers: ["https://install.crustdata.com/"]
GET /.well-known/oauth-authorization-server	200 → PKCE S256, registration_endpoint (DCR), authorization_code + refresh_token

Removing headersHelper is the change that hands the connection back to the client: while one is configured the plugin supplies the Authorization header itself, and a client-managed token has nothing to attach to.

Sign-in is now: Claude prompts on first Crustdata tool use, or /mcp → crustdata → Authenticate. Nothing to paste, no command to remember.

The PreToolUse gate had to be deleted rather than left inert — it exits 2 when the store has no token, and the store is now permanently empty, so it would have blocked every Crustdata tool call on a working connection.

Skill sync keeps its own path and now reads CRUSTDATA_API_KEY only. The client's token stays inside Claude Code with no supported way for a hook subprocess to read it, so the previously shared credential is gone. Without the env var the SessionStart hook no-ops exactly as it always did when no key was configured; bundled skills are unaffected. This is the one behaviour change worth a second opinion.

Net: −1,599 lines, five test files gone. Remaining suite (21 tests) green on Node 18/20/22/24 × 3 OS; the hook was also run standalone in both auth states (no key → one stderr line, exit 0; with key → normal path).

2. Migration to the current MCP server

candidate-sourcing and email-enrichment were written against the previous server's per-endpoint tools; both are replaced with their Code Mode rewrites (same workflows, driven through execute/callTool). Every remaining connector instruction points at install.crustdata.com/mcp.

3. Cross-platform CI

The suite runs on ubuntu × macos × windows over Node 18/20/22/24, so the documented Node ≥ 18 floor is enforced rather than asserted. This survives the deletion and now covers the sync hook.

Notes for review

• History is left as-is. Commits 1–4 harden the login flow that commit 10 deletes. Rebasing to surgically drop them would rewrite a branch that also carries the unrelated server migration; the net diff is what matters and is easy to read.
• Upgrade path: existing installs re-authenticate once via /mcp. They also keep a stale ~/.crustdata/credentials.json (or $CRUSTDATA_CONFIG_DIR) holding a live refresh token — nothing reads it any more, it is safe to delete, and the release notes should say so.
• Headless/CI: the env var no longer authenticates the MCP connection (only skill sync and direct API use). Native OAuth is interactive by nature. A headless setup needs its own server entry with a static Authorization header — which suppresses the 401 challenge and so cannot be layered on the same entry as native OAuth. Called out rather than half-solved.
• plugin.json 0.2.0 → 0.3.0 (user-visible auth change).

[tanvi-cd]

Superseded by crustdata/skills-internal#258 — the plugin is now maintained from skills-internal rather than here.

That PR adds a plugin/ folder holding this repo's entire source except skills/ (which the existing publish-to-public.yml already owns), plus a publish-plugin.yml hook that mirrors it onto this repo's root with rsync --delete. Deletion propagation is the reason it's a mirror rather than a copy: dropping a file there drops it here, which is what makes the login-stack removal in this PR actually land.

The tree in plugin/ is this PR's final state, so everything here ships when that one merges. Verified by running the exact mirror command against a real checkout of this repo's main: the 10 login-stack files delete, the manifests/README/hook update, and skills/ comes through untouched.

Closing rather than merging so there's one path into this repo. Nothing is lost — the branch stays if anything needs to be recovered.